Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
27-09-2024 19:26
General
-
Target
491eec6f62e89b017a00c2dccf51864afd6debf003a5e83d4081499a293d7221.exe
-
Size
25KB
-
MD5
342696fe21a53e26ed0fe6f07ab44807
-
SHA1
fd7d1ed14e6afa230d0f3a572c5b1d17972e3ef5
-
SHA256
491eec6f62e89b017a00c2dccf51864afd6debf003a5e83d4081499a293d7221
-
SHA512
72abdefa832defa0bf71c15159571fec0456787492c411cf749a78fdb77a6af01121459c4e4f84e57bf5cdeea32dbf22e43cf7705a9082504ca2b091ed133101
-
SSDEEP
384:5vcTz4TmmqZIQQptCtRZRe15p45cjAh+v2Y/Oz6JT8BNAZwBiy:5vkGQgctKp45h+OY/AC4Pl
Malware Config
Extracted
njrat
Njrat 0.7 Golden By Hassan Amiri
HacKed
harris974.ddns.net:5552
Windows Update
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Drops startup file 2 IoCs
-
Executes dropped EXE 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 33 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\491eec6f62e89b017a00c2dccf51864afd6debf003a5e83d4081499a293d7221.exe"C:\Users\Admin\AppData\Local\Temp\491eec6f62e89b017a00c2dccf51864afd6debf003a5e83d4081499a293d7221.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408B
MD54a02286231546d5a837701befc9aeafa
SHA1ca28fba9e5d36d4093ca5a5c0d9cc6fa88756710
SHA256c55d933eb6b3c6317d6c0ef97e400222493bafa7cf2007e8b2fd0653288a560f
SHA5125f27784009926af504353da5442acc75cb6509d942c3b7931f386408f5e0d6e4b0fec421f902b04af65ec3116850bb0e82e968d458b0632bb5f451bc5f4a7f93
-
Filesize
25KB
MD5342696fe21a53e26ed0fe6f07ab44807
SHA1fd7d1ed14e6afa230d0f3a572c5b1d17972e3ef5
SHA256491eec6f62e89b017a00c2dccf51864afd6debf003a5e83d4081499a293d7221
SHA51272abdefa832defa0bf71c15159571fec0456787492c411cf749a78fdb77a6af01121459c4e4f84e57bf5cdeea32dbf22e43cf7705a9082504ca2b091ed133101
-
Filesize
9.6MB
-
Filesize
72KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
72KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
624KB
-
Filesize
32KB
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
664KB
-
Filesize
72KB
-
Filesize
4.8MB
-
Filesize
9.6MB